Moderate Security Update for Python 3.11: URL Parser Vulnerability
Summary
ALSA-2025:7109: Moderate: python3.11 security update. Affects python3.11 versions < 3.11.11-2.el9. Fixed in 3.11.11-2.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.11 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features modules, classes, exceptions, and dynamic data types, making it highly versatile. However, a recent security vulnerability has been identified in the URL parser of Python 3.11, which allows square brackets in domain names, potentially leading to security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2025-0938, stems from the URL parser in Python 3.11, which improperly allows square brackets in domain names. This flaw can be exploited by attackers to craft malicious URLs that may bypass security checks, leading to potential security breaches, data leaks, or unauthorized access to sensitive information. The issue is particularly concerning for applications that rely on URL validation for security purposes.
How To Fix
Minimum fixed version
3.11.11-2.el9
This is the first release that contains the fix.
sudo dnf update python3.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional validation checks in your application to reject URLs containing square brackets in domain names until you can update to the patched version. This can be done using regular expressions to validate URLs before processing them.
Conclusion
In summary, the vulnerability in Python 3.11 related to the URL parser poses significant security risks. It is crucial to update to the patched version 3.11.11-2.el9 to safeguard your applications. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python3.11 →
FAQ
CVE-2025-0938 is a security vulnerability in Python 3.11 that allows square brackets in domain names, potentially leading to security risks.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The risks include potential security breaches, data leaks, and unauthorized access to sensitive information due to improper URL validation.
You can update Python 3.11 by running the command 'sudo dnf update python3.11' in your terminal to install the patched version.
Yes, you can implement additional validation checks in your application to reject URLs with square brackets in domain names as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11.
